SPLK-1001 inputlookup Practice Question
Exhibit
> splunk add lookup-table my_lookup my_lookup.csv
Refer to the exhibit. An administrator runs this command. What is the effect?
⚠ Common exam trap
Candidates often confuse `inputlookup` with commands that create lookup definitions, such as those available in Settings or via REST API. The command only reads existing lookup data, not creates it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Returns the contents of the CSV file as search results.
The command `inputlookup` reads the contents of the specified CSV file and returns them as search results. It does not create a lookup definition or persistent data input; it is a one-time import for the current search.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Returns the contents of the CSV file as search results.
Why this is correct
Correct. The inputlookup command reads a CSV lookup file and returns its contents as search results for the current search.
- ✗
Creates a lookup definition named my_lookup using the file my_lookup.csv.
Why it's wrong here
Incorrect. The inputlookup command does not create a lookup definition; it only reads data from an existing lookup table.
- ✗
Creates a lookup definition and automatically populates it with the file contents.
Why it's wrong here
Incorrect. The inputlookup command does not create or populate a lookup definition; it is a search command that retrieves data.
- ✗
Adds the file to the monitor directory.
Why it's wrong here
Incorrect. The inputlookup command does not add files to monitor directories; it only reads lookup data.
Go deeper
Related to this question
About these practice questions
One of 502 original SPLK-1001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.